﻿<?xml version="1.0" encoding="utf-8"?>
<!--Code Generated Analysis XML-->
<ULA>
  <Configuration>
    <Version>1.0.0</Version>
    <Product>SharePoint Server</Product>
    <Analysis>
      <Category>Web Apps, Sites, List and Libraries</Category>
      <XMLDescription>Web Apps, Sites, List and Libraries</XMLDescription>
    </Analysis>
  </Configuration>
  <ULAQuery>
    <Query>
	<ID>09804719-faa5-4c4d-9909-b1815814f519</ID>
	<Title>Throttling starts alert- Events 8032 8062 </Title>
	<Parameters>
		<EventID>Events 8032 8062 </EventID>
		<Message>http://technet.microsoft.com/en-us/library/ee513044</Message>
		<SQLQuery>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '8032' OR EventID = '8062'</SQLQuery>
		<RelevantLogCollection>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '8032' OR EventID = '8062'</RelevantLogCollection>
		<Symptom> The following symptoms might appear:

Users receive a 503 error in the browser: The server is busy now. Try again later.


This event appears in the event log: Event ID: 8032 Description: Http throttling starts because a heavy load was detected on [server name] the web app name. The excessive performance counters include: [performance counter name].


This event appears in the event log: Event ID: 8062 Description: Http throttling on [server name] stops because there is no heavy load detected now. [# of requests] requests have been throttled during the throttling period.
</Symptom>
		<Description>The front-end Web throttling feature is introduced in Microsoft SharePoint Foundation 2010 to keep the server from running out of resources for high-priority server jobs. Throttling monitors performance counters on the server and begins to reject low-priority jobs by returning a 503 error message when the counter values exceed or drop lower than predefined thresholds.
</Description>
		<Cause>Memory Available and/or ASP.NET\Requests Current have exceeded or dropped lower than the predefined threshold on the front-end Web servers.</Cause>
		<Articles>http://technet.microsoft.com/en-us/library/ee513044</Articles>
	</Parameters>
</Query>
    <Query>
      <ID>4b01e263-5718-41d0-b359-96cf4b0feb2f</ID>
      <Title>Central Administration update failed - Event 7037 </Title>
      <Parameters>
        <EventID>7037 </EventID>
        <Message>http://technet.microsoft.com/en-us/library/ff383247</Message>
        <SQLQuery>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '7037'</SQLQuery>
        <RelevantLogCollection>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '7037'</RelevantLogCollection>
        <Symptom>One or more of the following symptoms might appear:

Local server URL settings for the Central Administration Web site do not match the configured settings.


This event appears in the event log: Event ID: 7037 Description: Error creating timer job to update central administration url location at [URL].</Symptom>
        <Description>This error indicates that the Microsoft SharePoint Foundation 2010 timer job to update Central Administration on a specific URL was not created, or the local registry–based URL for the Central Administration was not updated.
</Description>
        <Cause>One or more of the following might be the cause:

The timer job that updates the Central Administration settings failed to be created. This failure may be caused by a communication failure with the configuration database while the configuration object was created.


The Central Administration URL registry location on the local server failed to be updated because of registry key permission issues.
</Cause>
        <Articles>http://technet.microsoft.com/en-us/library/ff383247</Articles>
      </Parameters>
    </Query>
    <Query>
      <ID>d9fc0d69-d07f-4c16-8e5d-8389745e7533</ID>
      <Title>Event receiver failed - Event 6875 </Title>
      <Parameters>
        <EventID>6875 </EventID>
        <Message>http://technet.microsoft.com/en-us/library/ff382637</Message>
        <SQLQuery>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '6875'</SQLQuery>
        <RelevantLogCollection>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '6875'</RelevantLogCollection>
        <Symptom>This event appears in the event log: Event ID: 6875 Description: Error loading and running event receiver [receiver name] in [receiver location]. Additional information is below. [additional information].</Symptom>
        <Description>In Microsoft SharePoint Foundation 2010, you can bind an event handler to an event host (such as an entire site, a list, or a document library). By binding an event handler to an event host, you can use document library events to start other processes, such as workflow processes.
</Description>
        <Cause>One or more of the following might be the cause:

The custom event receiver assembly cannot be found, or it is corrupted.


The SharePoint Foundation 2010 assembly cannot be found, or it is corrupted.
</Cause>
        <Articles>http://technet.microsoft.com/en-us/library/ff382637</Articles>
      </Parameters>
    </Query>
    <Query>
      <ID>3b52f6a3-6981-41c9-b6ad-e63399c30dcf</ID>
      <Title>Product Help Library Permission - Event 6769 </Title>
      <Parameters>
        <EventID>6769 </EventID>
        <Message>http://technet.microsoft.com/en-us/library/ee513055</Message>
        <SQLQuery>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '6769'</SQLQuery>
        <RelevantLogCollection>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '6769'</RelevantLogCollection>
        <Symptom>The following symptoms might appear:

End users cannot access the product Help.


This event appears in the event log: Event ID: 6769 Description: Unable to refresh permissions for Product Help Library Site Collection.
</Symptom>
        <Description> Microsoft SharePoint Foundation requires that specific permissions be set on the Product Help Library to correctly display Help to users. For this event ID the SCOM monitor monitors the permission configuration for this library. The Product Help Library is located in the Help Site Collection under the SharePoint Central Administration Web application.
</Description>
        <Cause>A problem with refreshing permissions for the Product Help Library Site Collection.</Cause>
        <Articles>http://technet.microsoft.com/en-us/library/ee513055</Articles>
      </Parameters>
    </Query>
    <Query>
      <ID>877dd9f1-5d45-4276-9d12-f84c585919f0</ID>
      <Title>Event handler failed to load - Event 6644</Title>
      <Parameters>
        <EventID>6644</EventID>
        <Message>http://technet.microsoft.com/en-us/library/ff382635</Message>
        <SQLQuery>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '6644'</SQLQuery>
        <RelevantLogCollection>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '6644'</RelevantLogCollection>
        <Symptom>This event appears in the event log: Event ID: 6644 Description: Event manager error: [error].
</Symptom>
        <Description> In Microsoft SharePoint Foundation 2010, you can bind an event handler to an event host (such as an entire site, a list, or a document library). By binding an event handler to an event host, you can use document library events to start other processes, such as workflow processes.
</Description>
        <Cause>One or more of the following might be the cause:

The custom event receiver assembly cannot be found, or it is corrupted.


The SharePoint Foundation 2010 assembly cannot be found, or it is corrupted.
</Cause>
        <Articles>http://technet.microsoft.com/en-us/library/ff382635</Articles>
      </Parameters>
    </Query>
    <Query>
      <ID>c3a57dec-3a39-47d8-bd39-cc37df5f5474</ID>
      <Title>Alternate access mapping update failed - Event 6397 </Title>
      <Parameters>
        <EventID>6397 </EventID>
        <Message>http://technet.microsoft.com/en-us/library/ee513060</Message>
        <SQLQuery>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '6397'</SQLQuery>
        <RelevantLogCollection>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '6397'</RelevantLogCollection>
        <Symptom>One or more of the following symptoms might appear:

The alternate access mapping settings for Web applications on the local server might not be current.


This event appears in the event log: Event ID: 6397 Alternate Access Mapping failed to be updated. Web Application affected: [Web Application]. Current user: [User Name]. More information is provided below.
</Symptom>
        <Description>Several features of Microsoft SharePoint Foundation 2010 rely on scheduled background processes called timer jobs. Administrators can configure and schedule timer jobs by using SharePoint Central Administration. When you use the Services on Server page of the SharePoint Central Administration Web site to start or stop a service, a timer job performs this action.

To improve the performance of SharePoint Foundation 2010, much of the data in the configuration database in SQL Server 2008 is kept in a local file-system cache, called the configuration data cache. SharePoint Foundation 2010 uses the timer service to keep this cache synchronized with the configuration database. Alternate access mapping is a feature of Microsoft SharePoint Foundation 2010 for administrators to configure a load-balanced system by mapping an incoming URL to alternate URLs that are used by SharePoint Foundation.

This error occurs when the timer job that is used to update alternate access mappings failed on the specified server.</Description>
        <Cause>The alternate access mapping specified in the configuration cache was not applied to the IIS settings of the local machine.</Cause>
        <Articles>http://technet.microsoft.com/en-us/library/ee513060</Articles>
      </Parameters>
    </Query>
    <Query>
      <ID>abaa3e55-6acf-4908-9f60-fe27794a3706</ID>
      <Title>Insufficient permissions to write to the configuration data cache - Event 6395 </Title>
      <Parameters>
        <EventID>6395</EventID>
        <Message>Assign sufficient permissions to the configuration data cache
Make sure that the WSS_ADMIN_WPG and WSS_RESTRICTED_WPG local groups have been granted permissions to write to the %systemdrive%\Users\All Users\Microsoft\SharePoint\Config directory. You must have Modify permissions to the directory in order to perform this task.</Message>
        <SQLQuery>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '6395'</SQLQuery>
        <RelevantLogCollection>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '6395'</RelevantLogCollection>
        <Symptom>The following message might appear in the event log: Event ID: 6395 Insufficient permissions to write to the configuration data cache. More information is included below.
</Symptom>
        <Description> Several features of Microsoft SharePoint Foundation 2010 rely on scheduled background processes called timer jobs. Administrators can configure and schedule timer jobs by using SharePoint Central Administration. When you use the Services on Server page of the SharePoint Central Administration Web site to start or stop a service, a timer job performs this action.

To improve the performance of SharePoint Foundation 2010, most of the data in the configuration database in SQL Server 2008 is kept in a local file-system cache, called the configuration data cache. SharePoint Foundation 2010 uses the timer service to keep this cache synchronized with the configuration database.

This error indicates that a permissions issue is preventing specific trusted accounts from writing to the %systemdrive%\Users\AllUsers\Microsoft\SharePoint\Config directory.</Description>
        <Cause>The configuration cache directory has security settings that prevent write access to its contents. Although configuration objects can be updated farm-wide, the objects are not updated locally.</Cause>
        <Articles>http://technet.microsoft.com/en-us/library/ee513065</Articles>
      </Parameters>
    </Query>
    <Query>
      <ID>ba7f999d-a2d9-488c-8970-9e4c7f313fc6</ID>
      <Title>SharePoint Foundation failed to create a site - Event 6141 </Title>
      <Parameters>
        <EventID>6141 </EventID>
        <Message>http://technet.microsoft.com/en-us/library/ee924653</Message>
        <SQLQuery>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '6141'</SQLQuery>
        <RelevantLogCollection>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '6141'</RelevantLogCollection>
        <Symptom>This event might appear in the event log: Event ID: 6141 Description: The site [Site Name] could not be created. The following exception occurred: [Exception Details].</Symptom>
        <Description>In Microsoft SharePoint Foundation 2010, administrators can create new SharePoint sites. Site owners and — depending on the site settings — site visitors can create subsites. This alert indicates that an attempt to create a new SharePoint site has failed.</Description>
        <Cause>One or more of the following could cause this:.

A configuration error.


The user does not have sufficient permission to create the site.


The user attempted to create a site with a non-valid character in the site name, such as '+'.


To determine the specific error, see the exception text in the event description.</Cause>
        <Articles>http://technet.microsoft.com/en-us/library/ee924653</Articles>
      </Parameters>
    </Query>
    <Query>
      <ID>36cbbf70-3a7a-48b7-84b2-ae2f63bc9591</ID>
      <Title>Active Directory organization unit unregistered - Event 3360 </Title>
      <Parameters>
        <EventID>3360 </EventID>
        <Message>http://technet.microsoft.com/en-us/library/ff383249</Message>
        <SQLQuery>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '3360'</SQLQuery>
        <RelevantLogCollection>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '3360'</RelevantLogCollection>
        <Symptom>One or more of the following symptoms might appear:

Account creation mode does not work correctly, which prevents user data from being added or read.

This event appears in the event log: Event ID: 3360 Description: The Active Directory organization unit [OU Name] registered in Windows SharePoint Services 4.0 does not exist.</Symptom>
        <Description> The Internet Information Services (IIS) application pool creates identities based on Active Directory users, and associates these identities by using a set of permissions. This lets users in an Active Directory organizational unit (OU) inherit those permissions.
</Description>
        <Cause>This can occur due to an error during provisioning or a run-time error that either caused the OU specified during farm configuration to not be created, or caused it to be renamed or deleted. Until this OU is created and registered, you cannot create a new site collection or add additional users.</Cause>
        <Articles>http://technet.microsoft.com/en-us/library/ff383249</Articles>
      </Parameters>
    </Query>
    <Query>
      <ID>3cfda755-2149-4208-ab59-51f286f91ccb</ID>
      <Title>The application pool account cannot add user accounts to Active Directory - Event 3359 </Title>
      <Parameters>
        <EventID>3359</EventID>
        <Message>http://technet.microsoft.com/en-us/library/ff383248</Message>
        <SQLQuery>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '3359'</SQLQuery>
        <RelevantLogCollection>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '3359'</RelevantLogCollection>
        <Symptom>One or more of the following symptoms might appear:

Account creation mode does not work correctly, which prevents user data from being added or read.

User accounts are not automatically created in Active Directory.

The event appears in the event log: Event ID: 3359 Description: The application pool account has insufficient permissions to add user accounts to Active Directory.</Symptom>
        <Description> The Internet Information Services (IIS) application pool creates identities based on Active Directory users, and associates these identities by using a set of permissions. This lets users in an Active Directory organizational unit (OU) inherit those permissions.
</Description>
        <Cause>The account that is used by the application pool does not have the appropriate level of permissions that are required to add new user accounts to Active Directory.</Cause>
        <Articles>http://technet.microsoft.com/en-us/library/ff383248</Articles>
      </Parameters>
    </Query>
    <Query>
      <ID>83c67616-ce6f-4290-a4fc-9cb967c6f111</ID>
      <Title>The document conversion is failing with presence of ULS entry "8eph Unexpected Error running the transform app. API: LogonUser, Error Code: 1385". </Title>
      <Parameters>
        <EventID>8eph</EventID>
        <Message>Check if "HVU_servername" or Guest group is part of "Deny Logon Locally" policy or not</Message>
        <SQLQuery>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '8eph'</SQLQuery>
        <RelevantLogCollection>SELECT TOP 1 * FROM [ULAtablename] WHERE EventID = '8eph'</RelevantLogCollection>
        <Symptom>In your SP 2010 farm you have configured Document Conversions Load Balancer and Launcher Services but its not working and throwing an error when trying to load the converter. 
Error : CE_OTHER</Symptom>
        <Description />
        <Cause>Built in group 'Guest' is added to 'Deny Logon Locally' by GP </Cause>
        <Articles />
      </Parameters>
    </Query>
    <Query>
      <ID>7e18bc0f-545c-40b1-a07c-7b8228ab4aca</ID>
      <Title>"Error initializing Safe control" in the ULS log when you use an Office 2010 Web App on a SharePoint server farm</Title>
      <Parameters>
        <EventID>-</EventID>
        <Message>To resolve this issue, configure the SharePoint server farm so that a managed account is running all essential app pools. </Message>
        <SQLQuery>SELECT TOP 1 Message FROM [ULAtablename] WHERE Message LIKE '%Error initializing Safe control - Assembly:Microsoft.Office.SharePoint.ClientExtensions%'</SQLQuery>
        <RelevantLogCollection>SELECT TOP 1 * FROM [ULAtablename] WHERE Message LIKE '%Error initializing Safe control - Assembly:Microsoft.Office.SharePoint.ClientExtensions%'</RelevantLogCollection>
        <Symptom>When you try to perform an operation with a Microsoft Office 2010 Web App, you encounter an error. This error includes a correlation ID number. For example, when you view the Unified Logging Service (ULS) log, you find an error that resembles the following: 

Error initializing Safe control - Assembly:Microsoft.Office.SharePoint.ClientExtensions, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c 
</Symptom>
        <Description>-</Description>
        <Cause>This issue occurs when a network service runs an app pool on a Microsoft SharePoint server farm.  
</Cause>
        <Articles>http://support.microsoft.com/kb/983007</Articles>
      </Parameters>
    </Query>
  </ULAQuery>
</ULA>